eccenca Corporate Memory GDPR Solution
2 likes11,679 views
This document discusses eccenca's semantic data management approach to help organizations solve their GDPR challenges. It outlines eccenca's GDPR solution, which is built on eccenca's Corporate Memory knowledge graph. The solution allows stakeholders like GDPR officers and application owners to integrate data from multiple domains, annotate data with processing purposes and legal bases, and generate reports and dashboards to monitor ongoing compliance. The solution can rapidly be deployed using eccenca's pre-configured GDPR ontology, legal taxonomy, and processing purpose repository.
eccenca Corporate Memory GDPR Solution
- 2. Agenda • “Wants and don‘t wants” • Challenges to be met • GDPR is an obligation – meet it • Put the data subject in the center of domains and activities • Integrate domains via Linked Data Management • eccenca’s GDPR solution © 2017 eccenca GmbH 2
- 3. You want to … • … achieve full transparency on your GDPR status • … successfully run regulatory audits • … manage your compliance processes • … present subject‘s data efficiently • … know on which legal basis you process personal data • … where data is processed, by whom and the processing purpose • … create meaningful actions on transparent insights Fulfilling GDPR rules is important & is an obligation You don‘t want to … • … pay high regulatory fines • … fail regulatory audits or miss deadlines • … put your firms reputation at risk • … waste time and resources in repetitive non-value adding regulatory efforts • … disturb your core business by running GDPR request • … overcharge your budget Fulfilling the GDPR rules is not easy in a heterogeneous data landscape. Linked Data Management overcomes deficiencies of traditional challenges. It will help you to comply with GDPR and create actionable insights in an easy to access and easy to understand manner without compromising your daily operations. © 2017 eccenca GmbH 3
- 4. § The data controller has to ... • provide evidence of being compliant with GDPR. • provide evidence which data of a subject is processed and stored where, for which purpose and by whom. • provide evidence on the legal basis processing data subjects' data, particularly on their given purpose based consent. • guarantee data portability on the data subject's request. • demonstrate that he can transform insights into actions and show how they are linked to GDPR articles. • be able to rectify and to delete any data of a data subject. • be able to deal with a subject's objection to process its data. Data Controllers are obliged to meet demanding tasks © 2017 eccenca GmbH 4
- 7. With Linked Data Management domains are integrated • A Linked Data approach stores alignment and transformation strategies on concept level within the Knowledge Graph • Queries run on the entire graph and create actionable insights • Automated type identification and re-use of alignment and transformation strategies across all data sources • Re-usability of developed rules • No hassle with inefficient ETL-jobs creating redundant information • No creation of again new data silos © 2017 eccenca GmbH 7
- 9. Rapid deployment model powered by pre configuration business content The user manages all concepts via the Vocabulary Management • eccenca GDPR Ontology • builds the foundation for the dashboard queries and the data mappings • it is pre-configured • eccenca Legal Base Taxonomy • uses terms from the GDPR ontology and describes legal basis‘ • it can be extended by the GDPR officer • it is pre-configured with commonly needed legal bases out of the box • Processing purpose repository • describes the processing purposes needed to annotate the data objects in the application data • is populated a priori, e.g. they can be extracted / integrated from an existing dataset or simply entered manually © 2017 eccenca GmbH 9
- 10. Make use of existing data sets The Dataset Management describes datasets from multiple angles • Consent Data • actual consent given by a data subject on a specific processing purpose • import from an already existing repository is possible • Application Data • data attributes of a data subject found in a specific application • datasets can be managed by the application owners, e.g. via Excel upload • You may want to load additional datasets which relate to each other • ⇒ just do it © 2017 eccenca GmbH 10
- 11. Transform, map and lift data – link datasets Put data easily in joint context with consent and processing purpose via the Data Integration system component • Application Data • transformed and semantically lifted data by using terms provided by the GDPR ontology • possible to query them in a joint context of the legal base taxonomy and the processing purpose repository • additional linking process can be used to reference the given application-specific data attributes with the generic and processing purpose referenced data attributes from the GDPR Ontology • Consent Data • transformed and lifted as mentioned above • Linked Data Network • a Linked Data Network realizes the Reporting Graph by integrating datasets, vocabularies and ontologies © 2017 eccenca GmbH 11
- 12. Identify GDPR status on data level and relate it to the rules The Data Exploration component is a generic graph data / Linked Data user interface • Explore and author Linked Data based on the RDF data model • Search for specific GDPR related data occurrences by using custom queries • Explore data with lists of resources based on GDPR ontology terms • Following links between resources in the reporting graph • Author new processing purposes (for data annotation) • Refine the legal basis for processing purposes. © 2017 eccenca GmbH 12
- 13. Wherever data reside, you can access them Endpoints and APIs provide machine-to-machine interfaces to all data assets • Data assets may be provided for or generated by eccenca Corporate Memory • REST APIs provide access to all relevant processes of the GDPR Solution package • SPARQL Endpoint is a general purpose query interface for all graph data including all vocabularies and the Reporting Graph • JDBC Interface allows for accessing data by means of SQL queries. JDBC Interfaces can be added on top of mapped datasets (also virtual datasets) © 2017 eccenca GmbH 13
- 14. Data Subject may ask for new administrative services a data controller is obliged to provide • Access to personal data processed by the data controller • Portability of personal data e.g. in the case of changing the service provider • Right to be forgotten – data deletion • Right of rectification of data Stakeholders are able to act on all levels GDPR Officer is supported in his/her active role in data protection – no longer just a consultant • Easily manages purposes, legal bases, and consent requirements • Gets a quick GDPR status via insights and dashboard • Controls correctness of annotation • Checks meta data by browsing • Drills down to the data level © 2017 eccenca GmbH 14 Regulatory entities supervise GDPR activities actively and passively • Audit companies‘ GDPR processes and state of compliance • Set specific rules for local data protection procedures • Ask for reports in general and in specific cases • Receives reports delivered by the GDPR Officer Application Owner is supported in his/her role in data protection • Register source data via the Data Management • Annotate data objects and link to processing purposes • Get direct access to meta data
- 16. Stakeholders are able to act on all levels • … and relate a ‘Consent’ to the legal basis it refers to • Show that you are able to prove compliance with GDPR • Therefor it is necessary to build the relation – GDPR with eccenca Corporate Memory does it © 2017 eccenca GmbH 16
- 18. Benefits powered by eccenca: • Fast implementation • Reusable rule, data and relation definition • Pre configured machine readable set of GDPR rules • No interference with daily operations • Drill down and deep dive into the data • Easy to access insights • Directly usable insights in compliance relevant processes • Concentrate on core business • Adding dataset is done much faster than in relational databases • Preserve compliance knowledge Make the most out of your data and compliance knowledge • Preserve compliance knowledge • Preserve data knowledge • Trust to run successful audit • Apply privacy by design at the data level. Tag private and personal data to be able to control the data flow within your parameters • Integrate data processors in your data landscape to have a lock on the data achieving joint accountability • Quickly realize data deletion on request and data portability by having full transparency of data storage • Reduce operational costs by increasing flexibility in data management • Ensure data portability by full transparency on linked data sets © 2017 eccenca GmbH 18